Bidirectional quantum secret sharing and secret splitting with polarized single photons 
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In this Letter, we present quantum secret sharing and secret splitting protocols with single photons 
running forth and back between the participating parties. The protocol has a high intrinsic efficiency, 
namely all photons except those chosen for eavesdropping check could be used for sharing secret. 
The participants need not to announce the measuring bases at most of the time and this reduces 
the classical information exchanged largely. 

PACS numbers: 03.67.Hk, 03.67.Dd, 89.70.+C 



The security of the secret message transmitted has be- 
come one of the most important issues for modern eco- 
nomic and security activities. The goal of cryptogra- 
phy is to make secret message only readable for the two 
authorized parties, the sender, Alice and the receiver, 
Bob, and unintelligible for any unauthorized man, say 
an eavesdropper Eve. To date, the only proven secure 
crypto-system in the classical information theory is the 
one-time-pad scheme Q in which the key is required to 
be as long as the message and is used just one time. 
The security of the message transmitted in this scheme 
depends entirely on the randomness of the private key. 
Alice and Bob have to distribute a lot of key before they 
start the secure communication. Quantum key distri- 
bution (QKD) has provided a secure way for transmit- 
ting private keys and it has progressed quickly Q since 
an original QKD protocol was proposed by Bennett and 
Brassard, the BB84 scheme 3]. The nocloning theorem 
of quantum state plays an important role in its secu- 
rity. 

Another applications of quantum mechanics within the 
field of information is quantum secret sharing (QSS) 
which is a quantum counterpart of classical secret sharing 
H . One of the main goals of QSS is to distribute private 
keys among the three, or more generally, multi- parties 
securely. With the key, the sender, Alice can divide the 
message into TV shares such that the other parties can 
read out the message only when they cooperate, and any 
set of less than N shares can get no information about the 
message. An original QSS scheme, the HBB99 scheme 
was proposed by Hillery, Buzek and Berthiaume in 
1999 using three-particle entangled Greenberger-Horne- 
Zeilinger (GHZ) states. In this scheme, the three par- 
ties, Alice, Bob and Charlie choose randomly two MBs, 
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a x and a y to measure the particles in their hands in- 
dependently. When they all choose a x or one chooses 
a x and the others choose a y , their results are corre- 
lated and will be kept for generating key, otherwise they 
discard the results. Its intrinsic efficiency, the ratio of 
number of theoretical valid transmitted qubits to the 
number of transmitted qubits is about 50% as half of 
the instances will be abandoned. Karlsson, Koashi and 
Imoto (KKI) put forward a QSS scheme Q with two- 
photon polarization-entangled states, and its intrinsic 
efficiency is also 50%. Now, there are many theoretic 
and experimental studies on QSS , for instance in Refs. 
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Most existing QSS protocols use entangled states and 
the participants choose randomly one of two sets of mea- 
suring bases(MBs), for examples the protocols proposed 
in Refs. @HEEEEElE[llEEl The in- 
trinsic efficiency of these protocols is usually 50%. Some 
techniques from QKD for improving the intrinsic effi- 
ciency 0, E, can be used for improving their effi- 
ciency in some QSS protocols. For example, the favored- 
measuring-basis technique pfj and the measuring-basis- 
encrypted technique |22j are extended to the multiparty 
QSS schemes in Ref. 0. In the measuring-basis- 
encrypted QSS scheme, a three-party control key is gen- 
erated first among the three parties, and they are used 
repeatedly to control the use of the alternative MBs. With 
a quantum storage [H E> E| > delayed measurement is 
possible and the efficiency of QSS can also be improved 

Entanglement is not necessary in quantum secret shar- 
ing. In Ref. |l9j , Guo and Guo proposed a QSS protocol 
without entanglement based on a modified BB84 QKD 
protocol and the efficiency is improved to approach 100%, 
with the use of quantum data storage. Single photons 
are ideal source for quantum communication. However 
at present, faint laser pulses are used to as approximate 
single photon sources. Recently we proposed a QKD pro- 
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tocol by using faint laser pulses travelling back and forth 
between the two parties pq . 

In this Letter, we present a QSS protocol without en- 
tanglement by combining the idea for QSS with QKD |l9j 
and the QKD protocol with faint laser pulses, the BID- 
QKD protocol in Rcf. 26). In the BID-QKD protocol, 
photon polarization states are used to encode informa- 
tion. First Bob prepares photons in one of the four pos- 
sible states ± z), ±x) randomly and then sends them to 
Alice. Alice performs some unitary operation to encode 
the information and then returns the photons to Bob. 
Bob reads out Alice's operation by making measurement. 
It was shown that the protocol is still secure if the number 
of photons in a pulse does not exceed two. Its intrinsic 
efficiency is improved to be 100%, and it does not require 
the use of a quantum data storage. Moreover, the clas- 
sical information exchanged is reduced since the parties 
of communication need not to announce the information 
about the measuring basis (MB) in most instances. It is 
feasible with present-day technique. We also apply the 
idea to quantum secret splitting. 

It is noted that any QKD protocol can be used for 
secret sharing if Alice can distribute a private key with 
each of the other parties. Let us use three parties, Alice, 
Bob and Charlie in secret sharing as an example, the 
naive-QKD QSS protocol. Alice creates the private key 
Kb with Bob, and Kc with Charlie. However one of 
the two parties Bob and Charlie maybe dishonest and 
the key they use to encrypt are denoted by K' B and K' c 
respectively. Alice needs to determine whether the key 
K' A = K' B © K' c obtained by combining Bob's key and 
Charlie's key is the same as her key Ka = Kb © Kc, 
where © means summing modulo 2. The process can be 
achieved by choosing random a sufficiently large subset 
of bits in the key K' A to compare the results with those 
in the key Ka- If the error rate is zero, Alice confirms 
that there is no dishonest one among Bob and Charlie, 
and she sends the ciphertext to them after encrypting it 
with the key Ka] otherwise she has to abort the secret 
message communication. In this way, secret sharing can 
be accomplished with private keys and the main goal of 
QSS is to distribute a key among the parties efficiently. 

QSS is more efficient for implementing the task of 
multi-party secret sharing than the above naive proto- 
col based on QKD. QSS is also secure as the legitimate 
parties can determine eavesdropping. QSS also reduces 
the resource requirement 0, 0, fioi - A figure of merit is 
the total efficiency r\ defined as |27ll28|. 



where b s is the number of secret bits in the key, qt is the 
number of qubit used, and bt is the number of classical 
bits exchanged between the parties. For example, the 
total efficiency of BB84 is // 25% as half of the 
instances will be discarded and at least one bit of classical 
information exchanged for each qubit, i.e., b s = 0.5, qt = 
1, bt = 1. In the naive-QKD QSS protocol, Alice creates 



the keys Kb and Kc with Bob and Charlie respectively, 
and the total efficiency for a multi-party key is rj = rj B ■ 
7] e = 12.5%. The HBB99 QSS protocol Q needs one and 
half bits of classical information for each qubit and half 
qubit is useful. Its total efficiency is i) HBfl8S = fjrf-g = 

20%. So is the KKI QSS protocol 0. 

In the following text, we present a QSS protocol us- 
ing two bi-directional QKD protocols proposed in Ref. 
[26j with single photons. This protocol spares the use of 
quantum data storage. We will present the idea with a 
three-party case first, and the generalization to N parties 
is also presented. 

For creating the key Ka, Alice prepares a two-photon 
product state \i/j)a = \<I>)b ® \4>)ci and \<P)b and \<j>)c 
are produced with two conjugate bases randomly: the 
rectilinear basis a z (i.e., \ + z) — |0), | — z) = |1)) and 
diagonal basis a x (i.e., | + x) = ^(|0) + |1)), \—x) = 

^(|0) - |1))). Thus the states of the B and C photons 

at Alice are randomly in one of the four states { | + z) , \ — 
z) , | +x) , | — x)} independently. She then sends the photon 
B to Bob and C to Charlie. Bob and Charlie choose 
randomly the two unitary operations U — i<j y = |0)(1| — 
|1}(0| and / = |0}(0| + |1)(1| for most photons except 
those chosen randomly for eavesdropping check. For the 
sampling photons, they choose randomly one of the two 
measuring bases (MBs) a z and a x to measure them, and 
then they tell Alice their MBs and results. Alice analyzes 
the error rate of the sampling photons, and determines 
whether there is an eavesdropper in the line. This is 
the first eavesdropping check. For other photons, Bob 
and Charlie send them back to Alice after encoding with 
the unitary operations, and Alice measures them with 
the same MBs o B a c e{<j z <j z , a z a x , a x a z , cr x a x } as she 
prepares them. The nice feature of the U operation is 
that it flips the state in both measuring basis, i.e., the 
effect of the operation U is only to negate (e.g., |0) — » 
|1), |1) — > |0) ) the quantum states in the same measuring 
basis [2^,|33, i.e., 

U\+z) = -\-z), U\-z) = \ + z), (2) 
U\+x) = \-x), U\-x) = -\+x). (3) 

Alice will get deterministic outcome for each photon re- 
turned in an ideal condition. 

For the security of whole process for QSS, Alice needs 
to choose randomly a sufficiently subset of result to ana- 
lyze for the eavesdropping check after the quantum com- 
munication is finished. This is the second eavesdropping 
check for creating the multi-party private key. The dif- 
ference of the state before she sends out and receives 
them is just the combined effect of the unitary opera- 
tions performed by Bob and Charlie. As the operations 
do not change the photons' MBs, the three parties do 
not need to announce the information about the MBs for 
most photons except the sampling ones. Then the uni- 
tary operations / and U can represent the bits and 1 
respectively, and each photon can carry one bit of secret 
message between two parties. The total efficiency of this 
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QSS approaches 77 = 100% as b s — 1, b t = 0, q t = 1. 

Because some qubits have been used in the two error 
analysis, the efficiency is less 1. Suppose there are 5 por- 
tion of transmitted qubits are used in each error checking, 
then the total efficiency becomes 



(4) 



and < S < 1/2. In the extreme case, 5 = 1/2, and 
the efficiency becomes 25%. When S approaches zero, r\ 
approaches 100%, and in general 0.25 < 77 < 1. Usually S 
is very small and is negligible, for instance as in Ref.|29j|. 
and 77 approaches 1. 

We now discuss the security of this QSS. It is pointed 
out that a QSS is secure for any eavesdropper if Alice 
can prevent the potential dishonest one between Bob and 
Charlie, say Bob* from eavesdropping the quantum com- 
munication 7]. Then the security depends on the pro- 
cess that Alice and Charlie* can detect the dishonest 
one, Bob*, if he eavesdrops the quantum channel. In 
fact, the process of this QSS is equal to two BID-QKD 
protocols J2II whose security bases on two BB84 QKD 
protocols |'l 1.3(1 l3lL with single photons. Alice can 
synchronously create a private Kb and Kc with Bob and 
Charlie respectively. In the end, Alice obtains the key 
Ka = Kb © Kc- For preventing Bob* from eavesdrop- 
ping, Alice and Charlie* just accomplish a BID-QKD 
process which is secure using single photons as quantum 
information carrier with two eavesdropping checks as a 
unknown state cannot be cloned 3, and the action of 
Bob* will disturb the quantum system and introduces 
error in the result in Kc*- The relation between the in- 
formation Iq(s) and the error rate e introduced by Bob* 
can be obtained 



Ia(s) < -elog 2 e - (1 -e)log 2 (l - e) 



(5) 



The probability Pd — £ that Bob* is detected will in- 
crease with the information Iq(e). If the error rate is 
low, the information Io(e) is small, and then the par- 
ties can distill a private key with privacy amplification 
0- Otherwise, they abandon the result. Certainly, the 
post-processing should include the error correction part. 

It is straightforwardly to generalize this QSS to multi- 
party secret sharing. Alice need only prepare a n-photon 
product state \tp)A and sends them to the other parties 
respectively, i.e., she sends the i-th photon to the i-th 
party. The total wave function Alice prepares is 



n 

i=l 



(6) 



where \<p)i G {| + z), \ — z), \ + x),\ — x)}. In this way, 
the multi-party QSS protocol is composed of n BID-QKD 
protocols. 

Another function of QSS is to split the secret message 
0, ■ The present QSS protocol can be used to accom- 
plish the task if we modify some part of the procedures 



following the ideas in quantum secure direct communi- 
cation 0, S IM III We also restrict our dis- 
cussion to three parties. There are two possible ways 
for doing the secret splitting. The first one follows the 
idea in the Ping-Pong deterministic secure communica- 
tion protocol |33l l34| in which the photons are trans- 
mitted one by one and it is asymptotically secure when 
the number of the qubits transmitted is large 33]. The 
other one is to use the quantum secure direct commu- 
nication (QSDC) protocol |3{| in which the photons are 
transmitted in a quantum data block and the message 
is encoded after the parties of communication confirm 
that the quantum channel is secure [3{| |3|| . For secret 
splitting, Alice prepares a random number string L, and 
adds it to the secret message S, i.e., G — L © S. The 
task of splitting the message is that Alice sends the string 
L to Bob and G to Charlie, and they can read out the 
message S — L © G when they collaborate. To this end, 
Alice requires Bob and Charlie send to her the polarized 
photons B and C. Assume the states of photons sent by 
Bob and Charlie are \4>)b and \4>}c respectively, where 
\4>)bi \4>)c G {| + z), I — z), I + x), I — x)}. Alice chooses 
randomly the control mode or the message mode, similar 
to Refs. |33J for the photons B and C independently . 
When she chooses the control mode, Alice measures the 
photons one of the two measuring bases(MBs) , a z and 
a x , randomly. She requires Bob or Charlie to publish her 
or his information about the state of the polarized pho- 
tons. When the message mode is chosen, Alice encodes L 
and C on the states \4>) b and \4>)c with the unitary oper- 
ation I or U according to the bit or 1 in L and G. She 
uses the results obtained with control mode as the sam- 
pling photons to analyze the error rate and determines 
whether there is an eavesdropper in the line. Alice needs 
to add some redundancy randomly on the sequence of B 
and C photons using the unitary operations / and U. 

In fact, this protocol for splitting the secret message is 
similar to two Ping-Pong protocols with single photons 
[3^|. The difference is just that the states of the photons 
are prepared with two sets of MBs a z and ov randomly 
as compared to only a single MB in Ref. [34|. Though 
a small difference, it improves the security largely. The 
relation between the information obtained by an eaves- 
dropper successfully and the probability that the parties 
detect her/him is the same as that for creating a private 
key, shown in equation (JjJJ. 

Taking the probability of choosing sampling photons 
for eavesdropping check p s into account, the probability 
for Bob* (Eve) to eavesdrop each qubit successfully is 



1-Pa 



1 - (1 - e)Ps 



(7) 



If Bob* (Eve) eavesdrops n bits of the qubits transmitted, 
the probability for Bob* (Eve) to successfully eavesdrop 
becomes 



l-Ps 



•l-(l-e)p, 



(8) 
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For e,p s > 0, the probability P(n,p s ,e) decrease expo- 
nentially. When the n is sufficiently large, it approaches 
zero. 

The information that Bob* (Eve) successfully eaves- 
drops is 1(e) — nIo(e) which is small with a low error 
rate. For example, if e = 0.1, n = 10000, P s = 0.1, then 
I (e = 0.1) < 0.47, F(10000,p s , e) = 10~ 48 . 

The other way for splitting the secret message can im- 
prove the security with the QSDC protocol |35| based 
on quantum data block [3^, |3(| at the cost of storing 
the quantum states for some times. The whole quantum 
communication can be divided into two procedures [35| : 
(1) the secure doves sending phase; (2) the message cod- 
ing and doves returning phase. It equals to two quantum 
one time pad QSDC (251 . I n the first phase, Bob and 
Charlie prepare their quantum state string L and G in- 
dependently with the two MBs, a z and a x . It means 
that Bob and Charlie send a group of doves to Alice re- 
spectively. In the second phase, Alice, Bob and Charlie 
determine whether there is an eavesdropper or dishon- 
est one monitoring the quantum channel. Alice encodes 
the message on the two groups of the doves if there is 
no one eavesdropping the quantum channel, and sends 
them back to Bob and Charlie. Otherwise, they abort 



the communication. 

For eavesdropping check, Alice has to store the two se- 
quence of quantum states that Bob and Charlie prepare 
with the two MBs randomly and send to her. The secu- 
rity is discussed in Ref. |35| in an ideal condition. With 
a noisy and lossy channel, the quantum communication 
can be strengthened with quantum privacy amplification 

i|. 

In order to be secure in practice, single photon source 
and quantum data storage technique are required. These 
techniques are principally available [2^, 13 Hf| 0, 0] . 
With the improvement of technology, the technique may 
be practically used for quantum information. 

In summary, we have proposed a QSS protocol for cre- 
ating a private multi-party key following the idea in bi- 
directional QKD with practical faint laser pulse [26j . The 
QKD with high total efficiency is useful for QSS as it re- 
duce the resource requirement for secret sharing. 
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